Decision RightsKeeping Peace in Your Organization

Cole Emerson

Continuity Insights Management Conference 2004

New Orleans, LA

2

Background

During the Cold War, military strategists strongly believed thatshould a conflict break out between the US military and the Soviet Union, the advantage US operations would have was the flexible decision-making authority each line unit had when engaging the enemy. In contrast, Soviet military units were not authorized to change any element of existing battle plans without permission from some Central Command. That lack of flexibility to independently act on changing conditions would create a significant handicap for the Soviets and a great advantage for the US.

3

Command & Control

Planning for and managing disasters is very much like a militaryoperation. Those at the front lines, in the midst of battle, know the actual conditions they have to deal with. A Corporate Command Team, located in the headquarters hundreds of miles away from the incident, cannot possibly assess and respond to the incident as well as the On-Site Command Team. The On-Site Command Team must have the authority to make key decisions without having to request it for each action. This is not to suggest that the remote sites have carte blanche to do anything they want to do. Flexibility within pre-defined boundaries is the objective for establishing decision rights agreements during the crisis management or business continuity planning efforts.

4

Decision Maker

The issue faced by many organizations at the time of a disaster is the lack of decision making authority between the Corporate Command Team versus the Site Command Team. The lack of clear-cut decision right guidelines leads to both confusion and contention during an actual incident.

5

Decision Rights

Who is authorized to make decisions during an incident?

What boundaries are set for those decisions?

How are the boundaries decided?

What if these parameters aren’t addressed prior to the incident?

6

Considerations

What are Decision Rights?

Why is it important to plan for?

Why types of decisions need to be addressed?

What are the benefits?

7

What If Authority Isn’t Addressed Prior To An Incident?

Scenario:

Fire at Financial Institution in Philadelphia.

– Command & Control in the street during the incident.

– Decisions made by HQ Team 100 miles away.

– Delays incurred due to inability to make immediate decisions at the site.

– Lack of decision rights delayed the recovery.

8

Problem Statement

Without clearly delineated decision rights, avoidable confusion,contention and delays occur during the coordination of response to incidents affecting remote sites.

9

Corporate

Decision rights are typically focused on policy, corporate image, and variance to policies or defined priorities and corporate initiated contracts or agreements.

10

Site

Decision rights are focused on local issues posing safety issuesand requiring immediate response, execution of predefined plans, communication to staff and site related vendors, acquisition of equipment (within the site budgetary authority), and deployment of staff within the immediate geographical area.

11

Peace: Decision Rights Process

Propose

Evaluate

Authorize or Decide

Concur

Execute

12

Peace

Propose

The entity submitting the requirement. During the planning or execution phase either Corporate or the Site may propose a course of action.

13

Peace

Evaluate

Assessing the proposed or completed action in the context of the overall implications to the corporation or the site. Corporate and the Site must evaluate the action and understand clearly how each action would affect each entity.

14

Peace

Authorize-Decide

Assessing the proposed or completed action in the context of the overall implications to the corporation or the site. Corporate and the Site must evaluate the action and understand clearly how each action would affect each entity.

15

Peace

Concur

A level less than authorization where prior to, during or immediately post action the entity agrees with the proposed or completed action. This also helps ensure interested parties arekept engaged in the process and are given the opportunity to provide feedback.

16

Peace

Execute

The entity responsible for acting on the proposed action.

17

Issue Types

Physical

Loss of life

Threats to staff and visitor safety

Threats to property

Threats to site assets

Threats against the company

18

Issue Types

Plan Changes

Changes in BC or DR plan priorities

Change in published strategies

Change in Command Team responsibilities

Change in Recovery Locations

19

Issue Types

Operational Changes

Transfer of Site functions to alternate site without cessation or degradation of operations

Transfer of Site functions to alternate site with cessation of operations

Transfer of Site functions to alternate site with degradation ofoperations

Variance from normal working hours

20

Issue Types

Public Communications

Release of information to the media

Release of information to customers

Release of information to business partners

Release of information to financial industry

21

Issue Types

Internal Communications

Release of information to the staff--environmental safety

Release of information to the staff--facility safety

Release of information--financial impact

Notification of next of kin

22

Issue Types

Contractual

Change to corporate managed contracts

Variance from terms of any labor related contracts

23

Issue Types

Information Security

Variance from intellectual property protection policies

Variance from information security policies

24

Issue Types

Human Resources

Variance to human resources policies

25

Issue Types

Budgetary

Capital expenditures within Site budgetary discretion

Capital expenditures greater than $XXXX

Process for tracking expenses

26

Example: Decision Rights Matrix

Issue Corporate Site

Loss of life, possible effects to personal safety, property safety, protection of site assets

Evaluate & ConcurAuthorize & Execute

Change in Site Continuity Plan Priorities

Evaluate & Concur Propose & Authorize & Execute

Expenditures less than $1.5MM

Evaluate & Concur Authorize & Execute

Expenditures greater than $1.5MM Authorize Propose & Execute

27

Example: Decision Rights Matrix

Issue Corporate Site

Media Release Evaluate, Authorize and Execute

Propose, Concur and Execute

Change in Contracts

Changes to HR Policies

Site Management Team Changes Evaluate and Concur Authorize and Execute

Evaluate, Authorize and Execute

Evaluate, Authorize and Execute

Propose and Concur

Propose and Concur

28

Example: Decision Rights Matrix

Issue Corporate Site

Transfer of Operations without degradation of

operations or cessation of response

Authorize and Execute

Transfer of Operations with degradation of operations and/or

cessation of response greater than 50%

Impact to Normal Operating Hours

Evaluate and Concur

Evaluate and Authorize Propose and Execute

Propose and Execute

Evaluate and Concur

29

Summary

Bottom Line

The bottom line is that pre-incident discussions, agreement on decision rights within the organization and documenting the guidelines may prevent hard feelings, reduce resistance and reduce confusion during an actual incident. It will help prevent sites from defaulting in their decision making responsibilities and help lessen the potential for the Corporate Command Team trying to assume total control over the remote incident.

30

Questions?

31

Speaker Information

Cole H. Emerson, MBCP CPP

Director - Risk Advisory Services

KPMG LLP

400 Capitol Mall

Suite 800

Sacramento, CA 95814

Office 916-554-1777

Mobile 916-296-9747

Fax 916-554-1193

Text 9162969747@mobile.att.net

Email chemerson@kpmg.com